Building consensus over DNSSEC enhancements to glibc.

[Andreas Schwab]

Zack Weinberg <zackw@panix.com> writes:

> First, I will note that at least one person in this discussion (Paul
> Wouters) wants to be able to outsource DNSSEC to a validating resolver
> that is *not* on 127.0.0.1.  This is obviously a terrible idea when
> there is a physical network in between the client and the validating
> resolver, and I *think* he conceded that point to Rich, but he brought
> up the possibility of containers or VMs outsourcing to a validating
> resolver in another container or on the host, via a VLAN.  It seems to
> me that even in that case we cannot be *certain* that response forgery
> is impossible (does the kernel actually contract to prevent address
> spoofing? are you *sure* there are no bugs?).

If the admin says so he should be able to assert it.  glibc has no
business to second-guessing.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."